iGaming & Gambling Compliance in France

The French market is open but narrow. Online sports betting, horse-race betting and poker are open to competition under licences from the ANJ; lotteries and land-based sports betting are run under exclusive rights, land-based horse betting through the racing companies, and casinos under individual authorisations. All other gambling is prohibited.

The ANJ licenses and supervises online operators, including their anti-money laundering controls, and refers anti-money laundering breaches to the Commission nationale des sanctions. Tracfin receives suspicious transaction reports and the Treasury keeps the national asset-freeze register.

The biggest obstacle for a new entrant is the per-player control burden on a dedicated .fr site: identity, age, address, exclusion status and payment account ownership all have to be established before a cent can be withdrawn, inside a 30-day window, under a regulator that has started to sanction failures.

1. Who regulates this sector

The ANJ's anti-money laundering supervision of online and exclusive-rights operators rests on art. L561-36-2 IV of the Code monétaire et financier (CMF). Casinos and gaming clubs are supervised instead by the Service central des courses et jeux, with inspections by the national police gaming unit (art. R561-39 CMF); the interior, economy or budget minister refers their breaches to the CNS (art. L561-38 2°).

2. Licensing and authorisation

Gambling is prohibited in France unless a statute creates an exception (art. L320-1 of the Code de la sécurité intérieure, CSI). The exceptions in art. L320-6 CSI are casinos, lotteries and land-based sports betting under exclusive rights, land-based horse betting under exclusive rights, and online horse betting, sports betting and poker ("jeux de cercle") under licences. Casinos hold temporary authorisations limited to listed categories of resort and tourist towns (art. L321-1 CSI). No online casino games (slots, roulette, blackjack) are on the list; a Government amendment to the 2025 finance bill that would have opened them was withdrawn before debate in October 2024.

Online licences (agréments)

Under art. 21 of loi n° 2010-476 of 12 May 2010 (in force since 1 January 2020), the ANJ issues a separate licence for each of online horse betting, sports betting and poker. Licences last five years, are renewable and cannot be transferred. Applicants must have their registered office in the EU or an EEA state with a tax-assistance agreement with France, and refusal grounds include anti-money laundering concerns and excessive-gambling risk. The ANJ list showed 16 licensed operators running 22 websites (October 2026).

Within a year of licensing the operator must obtain independent certification against the ANJ's integrity and security requirements, renewed annually (art. 23 III), and each year it submits its promotional strategy, excessive-gambling plan and anti-money laundering action plan for approval (art. 34).

Operating without a licence

Offering online betting or gambling without a licence or exclusive right is punishable by three years' imprisonment and a 90,000 euro fine, rising to seven years and 200,000 euros for organised groups (art. 56). Advertising an unlicensed site carries a 100,000 euro fine, up to four times the advertising spend (art. 57). The ANJ can order blocking and payment blocking (section 5).

3. AML, KYC and customer due diligence

Online operators licensed under art. 21 of the 2010 law, the exclusive-rights operators and their legal representatives are obliged entities under art. L561-2 9° bis CMF; casinos and gaming clubs fall under 9°. The ANJ checks online and exclusive-rights operators' compliance and refers breaches to the CNS (art. 34 X of the 2010 law; art. L561-38 2° bis CMF).

The operational rulebook is the ANJ's Cadre de référence pour la lutte contre la fraude et contre le blanchiment de capitaux et le financement du terrorisme, adopted by arrêté of 9 September 2021. It requires:

Risk assessment

A written classification of risks by product, channel, customer profile and country of origin or destination of funds, updated before new services launch.

Customer due diligence

Identity, age, address and payment account holder verified for every account; players are natural persons, so no beneficial ownership search. Re-verify in case of doubt.

Enhanced measures

Politically exposed persons (art. L561-10 CMF), players from FATF or EU high-risk countries, and unusually large or complex operations (art. L561-10-2): source of funds and reinforced monitoring.

Governance

A qualified anti-money laundering officer, two-level internal control, a Tracfin declarant, and an annual action plan filed before 31 January.

Reporting and freezing

Operators must not carry out an operation they suspect is linked to money laundering or terrorist financing until they have reported it to Tracfin through ERMES (art. L561-16 CMF); there is no reporting threshold. On suspicion they may defer crediting a deposit or paying out a balance, but must then file the report (arts. 9 and 15 of décret n° 2010-518). Asset-freeze measures apply without delay: screen at onboarding and continuously against the Treasury register, block designated persons, freeze deposits and inform the Minister of the Economy immediately.

Thresholds and retention

Online, every player is identified regardless of amount. Off-account play in the land-based network requires identification when a player stakes or wins 2,000 euros or more per transaction, and in casinos when exchanges of chips or payment means reach 2,000 euros per session (art. R561-10 II 6° and 6° bis CMF); above those amounts the player's identity and the sums involved are recorded and kept for five years (art. R561-22-2). The framework adds identification for a single payment of several prizes above 300 euros. Due diligence and transaction records are kept for five years after the account closes or the transaction is executed (art. L561-12).

4. Identity verification and onboarding

Player accounts are governed by décret n° 2010-518 of 19 May 2010, in its version in force since 1 October 2020 (décret n° 2020-494).

What is collected and refused

Before opening, the operator collects birth name, first names, date and place of birth and postal address, and must refuse anyone who does not supply all of this, any minor and anyone under a gambling ban (art. 2).

How identity is verified

Article 4 offers two routes:

• Electronic identification under 1° or 2° of art. R561-5-1 CMF: an eID means certified or attested by the national cybersecurity agency (ANSSI) at eIDAS "substantial" or "high" level, an eID under a scheme notified to the European Commission at those levels, or a means presumed reliable under art. L102 of the postal and electronic communications code.
• Documents: within 30 days of the request, a copy of a valid national ID card, passport, driving licence, residence permit or resident card showing identity and date of birth, plus proof of address by a document (rent receipt, utility, internet or phone bill, tax notice) or by entering an activation code the operator sends to the postal address.

Without them after 30 days the provisional account is deactivated; after 60 days it is closed and any balance held for six years (arts. 4, 6 and 8). This sector rule displaces the general CMF requirement to combine at least two remote verification measures: where electronic identification or in-person checks are not used, online operators verify identity and address under the player-account rules (art. R561-5-3 1° CMF). The ANJ framework recommends electronic identification and otherwise rigorous document checks.

Payment account and limits

No withdrawal is possible before the operator has received a document showing the references of a payment account in the player's name (art. 5). Winnings can be paid only by transfer to a single payment account held by the player with an EU or EEA payment service provider, and accounts can be funded only with payment instruments from such providers (art. 17 IV and VI of the 2010 law). Before the first deposit the player sets a seven-day deposit limit, before the first bet a seven-day stake limit, and for poker a playing-time limit; increases take effect after 48 hours, decreases immediately (arts. 16 and 16-1).

5. Digital channels: what's different

Bottom line: online play requires an identified, verified account for every player from the first euro, while the land-based network allows anonymous play below 2,000 euros per transaction.

Domain and redirection instead of geolocation

A licensed operator must run a dedicated .fr site and redirect to it every connection to its or its subsidiaries' sites from a terminal in France or from a French-resident player's account (art. 24 of the 2010 law). The law frames this as redirection, not device geolocation.

Blocking of illegal offers, including circumvention tools

After formal notice, the ANJ president orders internet access providers, search engines and, since 5 August 2026, circumvention services such as VPNs to block or de-list illegal sites [In force since 5 Aug 2026] (art. 61, as amended by loi n° 2026-725). The president can also ban payments to and from an illegal operator's accounts for six renewable months (art. L563-2 CMF). The ANJ blocked the prediction market Polymarket in July 2026, citing its lack of identity checks among other concerns.

6. Data protection and biometrics

The GDPR and loi n° 78-17 of 6 January 1978 apply. Players must be told the ANJ may receive their data (art. 2 of the decree), which operators keep permanently available to it (art. 38 of the 2010 law). Account-opening and identity data are kept six years after account closure (art. 31 of the decree), due diligence records five years (CMF).

No gambling rule requires biometric checks by operators. Under the non-binding data protection guide the ANJ produced with the CNIL in 2026, an operator adding facial recognition or other biometric checks should justify their proportionality, must obtain explicit consent (Article 9(2)(a) GDPR) and must carry out an impact assessment; exclusion-file data may not be reused for marketing. The ANJ's own online self-exclusion service follows the same model: explicit consent, a postal alternative, and immediate deletion of biometric data by its processor (ANJ notice of 19 February 2026).

7. Sector-specific obligations

Gambling bans and self-exclusion

A voluntary gambling ban lasts three years and renews tacitly; it covers casinos, licensed online sites, the online lottery and self-service terminals (art. L320-9-1 CSI). Administrative bans of up to five years can now be imposed for online harassment of athletes. Operators must block banned players, close their accounts and send them no marketing (arts. L320-9 and L320-11), and must offer their own self-exclusion of 24 hours to 12 months (art. 18 of the decree).

Excessive gambling and minors

Minors, even emancipated, may not gamble (arts. L320-7 and L320-8 CSI). Operators must identify and support players whose gambling is excessive under a health ministry framework (art. 34 IX of the 2010 law).

Gambling on credit, and lending to players, are prohibited (art. L320-17).

8. Risk indicators and red flags

Typologies identified by the ANJ for French gambling

• Withdrawal without play: deposits paid out with little or no play.
• Poker collusion: players losing deliberately to an accomplice to move funds as winnings.
• Low-risk betting patterns: covering all outcomes or repeatedly backing heavy favourites.
• Insider information and match fixing: unusual bets on events at risk of manipulation.
• Prepaid cards and e-wallets: funding methods the ANJ identifies as favouring laundering.
• Splitting below thresholds: land-based stakes or winning tickets cashed just under 2,000 euros, or mixing online and retail play.
• Document fraud and identity theft: falsified or borrowed identities at account opening.
• Bots and automated play: detected with behavioural tools.

9. Enforcement and penalties

ANJ sanctions committee (art. 43 of the 2010 law): warning, licence shortened by up to one year, suspension for up to three months or withdrawal (with a ban on reapplying for up to three years). Instead or in addition, a fine of up to 5% of the previous year's pre-tax turnover from licensed activities (10% for a repeat), or 150,000 euros (375,000) where no turnover exists. Obstructing an investigation or supplying inaccurate information: up to 100,000 euros. Decisions may be published.

Commission nationale des sanctions (art. L561-40 CMF) for anti-money laundering breaches: warning, reprimand, temporary ban of up to five years, licence withdrawal, and fines of up to 5 million euros or twice the benefit obtained, against the operator and its managers or staff personally involved.

Recent actions. On 22 July 2026, in the first case referred by the ANJ, the CNS sanctioned a licensed online operator for asset-freeze failures (no internal procedures, no notice to the Minister of the Economy): a suspended two-month ban and 20,000 euros for the company, and suspended bans with fines of 20,000 and 5,000 euros for two individuals, one of them the compliance officer (decision 2025-65). On 10 July 2026 the ANJ committee fined an operator 500,000 euros for player-protection failures (decision 2026-031). Both decisions can be challenged before the Conseil d'État, which on 11 June 2026 upheld a 150,000 euro ANJ fine on Betclic Enterprises for exceeding the 85% return-to-player cap (n° 500722).

10. Recent changes and what to watch

• 10 July 2027: EU Anti-Money Laundering Regulation applies[Adopted, applies 10 Jul 2027]. Regulation (EU) 2024/1624 replaces much of the CMF regime with directly applicable rules, including due diligence for gambling transactions of 2,000 euros or more (Art. 19(5)) and eIDAS-based remote verification (Art. 22(6)). AMLA's draft standards on due diligence (consultation closed 8 May 2026) are not yet adopted.
• 1 January 2027: loss limits and young-adult protection[Adopted, effective 1 Jan 2027]. Operators must add loss limits; players aged 18 to 25 can raise limits only after a decree-set period of at least two weeks, and the ANJ may cap their losses for up to a year (art. L320-11 CSI as amended by loi n° 2026-725).
• 22 July 2026: first anti-money laundering sanction[Decided]. The CNS penalised an operator and two individuals for asset-freeze failures. Screening and freeze procedures are now an enforcement priority.
• 16 July 2026: Polymarket blocked[In force]. The ANJ treats prediction markets as illegal gambling sites in France.
• 5 August 2026: loi n° 2026-725 in force[In force]. Blocking orders now reach VPN and other circumvention services, and harassment of athletes can lead to an administrative gambling ban.
• 7 February 2026: digital collectible games regime[In force]. Décret n° 2026-60 implements the experimental regime for monetisable digital-object games (JONUM): adults only, and no account until identity and age are verified by a reliable means, within 30 days.

11. What this means for identity verification

• Design for a 30-day window. Verification runs alongside provisional play, with deactivation on day 30, closure on day 60 and withdrawals blocked throughout.
• Two verification paths. eIDAS "substantial" or "high" electronic identities for instant verification, and a document route for five French document types plus proof of address or a postal activation code, with forgery checks.
• Exact data matching. Documents must match the declared birth name, first names, date and place of birth; typing errors can be corrected within 60 days, other mismatches close the account.
• Payment account ownership. Confirm the single withdrawal account is in the player's name at an EU or EEA provider before any payout.
• Recurring checks. Exclusion check at every login, continuous freeze screening, and re-verification within 30 days of any civil-status or address change (art. 12).
• Biometrics by consent. Any selfie or liveness step needs explicit consent, a proportionality case and an impact assessment; identity data are kept six years after account closure.